1. Field of the Invention
The present invention relates generally to computer networking and computer software.
2. Description of the Background Art
Virus throttling or connection-rate filtering is a technique for containing the damage caused by fast-spreading worms and viruses. Rather than attempting to prevent a computing machine from becoming infected, virus throttling inhibits the spreading of the worm or virus from an infected machine. This reduces damage because the worm or virus is able to spread less quickly, and this also reduces the network traffic caused by such worms and viruses.
Virus throttling is based on controlling an infected machine's network behavior, and so does not rely on details of the specific virus. In other words, a virus signature is not needed to implement connection rate filtering. Although virus throttling does not prevent infection in the first place, it helps to contain damage by restricting the spread of the virus. With such throttling, a virus or worm outbreak will grow less rapidly, and the network load will be reduced. Further, by damping down the spread of the virus or worm, the throttling buys time for signature-based solutions to reach machines before the virus or worm.
Virus throttling technology has been implemented in the ProCurve® Switch 5300xl available from the Hewlett Packard Company. In the ProCurve® Switch 5300xl, virus throttling works by intercepting Internet Protocol (IP)-routed connection requests in which the source subnet and the destination subnet are different. When a given host exceeds a certain number of unique routed connections within a specific amount of time, the switch may consider this host to be infected by malicious code (such as a virus or worm) and may take appropriate actions.
It is highly desirable to control the spread of computer viruses and other malicious code. More particularly, it is highly desirable to improve methods and apparatus for virus throttling or connection-rate filtering.